src/test/test-condition.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <stdio.h>
   4 #include <sys/types.h>
   5 #include <sys/utsname.h>
   6 #include <unistd.h>
   7
   8 #include "sd-id128.h"
   9
  10 #include "alloc-util.h"
  11 #include "apparmor-util.h"
  12 #include "architecture.h"
  13 #include "audit-util.h"
  14 #include "cgroup-util.h"
  15 #include "condition.h"
  16 #include "cpu-set-util.h"
  17 #include "efi-loader.h"
  18 #include "errno-util.h"
  19 #include "hostname-util.h"
  20 #include "id128-util.h"
  21 #include "ima-util.h"
  22 #include "limits-util.h"
  23 #include "log.h"
  24 #include "macro.h"
  25 #include "nulstr-util.h"
  26 #include "process-util.h"
  27 #include "selinux-util.h"
  28 #include "set.h"
  29 #include "smack-util.h"
  30 #include "string-util.h"
  31 #include "strv.h"
  32 #include "tests.h"
  33 #include "tomoyo-util.h"
  34 #include "user-util.h"
  35 #include "virt.h"
  36
  37 static void test_condition_test_path(void) {
  38         Condition *condition;
  39
  40         condition = condition_new(CONDITION_PATH_EXISTS, "/bin/sh", false, false);
  41         assert_se(condition);
  42         assert_se(condition_test(condition));
  43         condition_free(condition);
  44
  45         condition = condition_new(CONDITION_PATH_EXISTS, "/bin/s?", false, false);
  46         assert_se(condition);
  47         assert_se(condition_test(condition) == 0);
  48         condition_free(condition);
  49
  50         condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, false);
  51         assert_se(condition);
  52         assert_se(condition_test(condition) > 0);
  53         condition_free(condition);
  54
  55         condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, true);
  56         assert_se(condition);
  57         assert_se(condition_test(condition) == 0);
  58         condition_free(condition);
  59
  60         condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, false);
  61         assert_se(condition);
  62         assert_se(condition_test(condition) == 0);
  63         condition_free(condition);
  64
  65         condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, true);
  66         assert_se(condition);
  67         assert_se(condition_test(condition) > 0);
  68         condition_free(condition);
  69
  70         condition = condition_new(CONDITION_PATH_IS_DIRECTORY, "/bin", false, false);
  71         assert_se(condition);
  72         assert_se(condition_test(condition) > 0);
  73         condition_free(condition);
  74
  75         condition = condition_new(CONDITION_DIRECTORY_NOT_EMPTY, "/bin", false, false);
  76         assert_se(condition);
  77         assert_se(condition_test(condition) > 0);
  78         condition_free(condition);
  79
  80         condition = condition_new(CONDITION_FILE_NOT_EMPTY, "/bin/sh", false, false);
  81         assert_se(condition);
  82         assert_se(condition_test(condition) > 0);
  83         condition_free(condition);
  84
  85         condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/bin/sh", false, false);
  86         assert_se(condition);
  87         assert_se(condition_test(condition) > 0);
  88         condition_free(condition);
  89
  90         condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/etc/passwd", false, false);
  91         assert_se(condition);
  92         assert_se(condition_test(condition) == 0);
  93         condition_free(condition);
  94
  95         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/proc", false, false);
  96         assert_se(condition);
  97         assert_se(condition_test(condition) > 0);
  98         condition_free(condition);
  99
 100         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/", false, false);
 101         assert_se(condition);
 102         assert_se(condition_test(condition) > 0);
 103         condition_free(condition);
 104
 105         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/bin", false, false);
 106         assert_se(condition);
 107         assert_se(condition_test(condition) == 0);
 108         condition_free(condition);
 109
 110         condition = condition_new(CONDITION_PATH_IS_READ_WRITE, "/tmp", false, false);
 111         assert_se(condition);
 112         assert_se(condition_test(condition) > 0);
 113         condition_free(condition);
 114
 115         condition = condition_new(CONDITION_PATH_IS_SYMBOLIC_LINK, "/dev/stdout", false, false);
 116         assert_se(condition);
 117         assert_se(condition_test(condition) > 0);
 118         condition_free(condition);
 119 }
 120
 121 static void test_condition_test_control_group_controller(void) {
 122         Condition *condition;
 123         CGroupMask system_mask;
 124         CGroupController controller;
 125         _cleanup_free_ char *controller_name = NULL;
 126         int r;
 127
 128         r = cg_unified();
 129         if (r < 0) {
 130                 log_notice_errno(r, "Skipping ConditionControlGroupController tests: %m");
 131                 return;
 132         }
 133
 134         /* Invalid controllers are ignored */
 135         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, false);
 136         assert_se(condition);
 137         assert_se(condition_test(condition) > 0);
 138         condition_free(condition);
 139
 140         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, true);
 141         assert_se(condition);
 142         assert_se(condition_test(condition) == 0);
 143         condition_free(condition);
 144
 145         assert_se(cg_mask_supported(&system_mask) >= 0);
 146
 147         /* Individual valid controllers one by one */
 148         for (controller = 0; controller < _CGROUP_CONTROLLER_MAX; controller++) {
 149                 const char *local_controller_name = cgroup_controller_to_string(controller);
 150                 log_info("chosen controller is '%s'", local_controller_name);
 151                 if (system_mask & CGROUP_CONTROLLER_TO_MASK(controller)) {
 152                         log_info("this controller is available");
 153                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
 154                         assert_se(condition);
 155                         assert_se(condition_test(condition) > 0);
 156                         condition_free(condition);
 157
 158                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
 159                         assert_se(condition);
 160                         assert_se(condition_test(condition) == 0);
 161                         condition_free(condition);
 162                 } else {
 163                         log_info("this controller is unavailable");
 164                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
 165                         assert_se(condition);
 166                         assert_se(condition_test(condition) == 0);
 167                         condition_free(condition);
 168
 169                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
 170                         assert_se(condition);
 171                         assert_se(condition_test(condition) > 0);
 172                         condition_free(condition);
 173                 }
 174         }
 175
 176         /* Multiple valid controllers at the same time */
 177         assert_se(cg_mask_to_string(system_mask, &controller_name) >= 0);
 178
 179         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, false);
 180         assert_se(condition);
 181         assert_se(condition_test(condition) > 0);
 182         condition_free(condition);
 183
 184         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, true);
 185         assert_se(condition);
 186         assert_se(condition_test(condition) == 0);
 187         condition_free(condition);
 188 }
 189
 190 static void test_condition_test_ac_power(void) {
 191         Condition *condition;
 192
 193         condition = condition_new(CONDITION_AC_POWER, "true", false, false);
 194         assert_se(condition);
 195         assert_se(condition_test(condition) == on_ac_power());
 196         condition_free(condition);
 197
 198         condition = condition_new(CONDITION_AC_POWER, "false", false, false);
 199         assert_se(condition);
 200         assert_se(condition_test(condition) != on_ac_power());
 201         condition_free(condition);
 202
 203         condition = condition_new(CONDITION_AC_POWER, "false", false, true);
 204         assert_se(condition);
 205         assert_se(condition_test(condition) == on_ac_power());
 206         condition_free(condition);
 207 }
 208
 209 static void test_condition_test_host(void) {
 210         _cleanup_free_ char *hostname = NULL;
 211         char sid[SD_ID128_STRING_MAX];
 212         Condition *condition;
 213         sd_id128_t id;
 214         int r;
 215
 216         r = sd_id128_get_machine(&id);
 217         assert_se(r >= 0);
 218         assert_se(sd_id128_to_string(id, sid));
 219
 220         condition = condition_new(CONDITION_HOST, sid, false, false);
 221         assert_se(condition);
 222         assert_se(condition_test(condition) > 0);
 223         condition_free(condition);
 224
 225         condition = condition_new(CONDITION_HOST, "garbage value jjjjjjjjjjjjjj", false, false);
 226         assert_se(condition);
 227         assert_se(condition_test(condition) == 0);
 228         condition_free(condition);
 229
 230         condition = condition_new(CONDITION_HOST, sid, false, true);
 231         assert_se(condition);
 232         assert_se(condition_test(condition) == 0);
 233         condition_free(condition);
 234
 235         hostname = gethostname_malloc();
 236         assert_se(hostname);
 237
 238         /* if hostname looks like an id128 then skip testing it */
 239         if (id128_is_valid(hostname))
 240                 log_notice("hostname is an id128, skipping test");
 241         else {
 242                 condition = condition_new(CONDITION_HOST, hostname, false, false);
 243                 assert_se(condition);
 244                 assert_se(condition_test(condition) > 0);
 245                 condition_free(condition);
 246         }
 247 }
 248
 249 static void test_condition_test_architecture(void) {
 250         Condition *condition;
 251         const char *sa;
 252         int a;
 253
 254         a = uname_architecture();
 255         assert_se(a >= 0);
 256
 257         sa = architecture_to_string(a);
 258         assert_se(sa);
 259
 260         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, false);
 261         assert_se(condition);
 262         assert_se(condition_test(condition) > 0);
 263         condition_free(condition);
 264
 265         condition = condition_new(CONDITION_ARCHITECTURE, "garbage value", false, false);
 266         assert_se(condition);
 267         assert_se(condition_test(condition) == 0);
 268         condition_free(condition);
 269
 270         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, true);
 271         assert_se(condition);
 272         assert_se(condition_test(condition) == 0);
 273         condition_free(condition);
 274 }
 275
 276 static void test_condition_test_kernel_command_line(void) {
 277         Condition *condition;
 278         int r;
 279
 280         condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "thisreallyshouldntbeonthekernelcommandline", false, false);
 281         assert_se(condition);
 282         r = condition_test(condition);
 283         if (ERRNO_IS_PRIVILEGE(r))
 284                 return;
 285         assert_se(r == 0);
 286         condition_free(condition);
 287
 288         condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "andthis=neither", false, false);
 289         assert_se(condition);
 290         assert_se(condition_test(condition) == 0);
 291         condition_free(condition);
 292 }
 293
 294 static void test_condition_test_kernel_version(void) {
 295         Condition *condition;
 296         struct utsname u;
 297         const char *v;
 298
 299         condition = condition_new(CONDITION_KERNEL_VERSION, "*thisreallyshouldntbeinthekernelversion*", false, false);
 300         assert_se(condition);
 301         assert_se(condition_test(condition) == 0);
 302         condition_free(condition);
 303
 304         condition = condition_new(CONDITION_KERNEL_VERSION, "*", false, false);
 305         assert_se(condition);
 306         assert_se(condition_test(condition) > 0);
 307         condition_free(condition);
 308
 309         /* An artificially empty condition. It evaluates to true, but normally
 310          * such condition cannot be created, because the condition list is reset instead. */
 311         condition = condition_new(CONDITION_KERNEL_VERSION, "", false, false);
 312         assert_se(condition);
 313         assert_se(condition_test(condition) > 0);
 314         condition_free(condition);
 315
 316         assert_se(uname(&u) >= 0);
 317
 318         condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
 319         assert_se(condition);
 320         assert_se(condition_test(condition) > 0);
 321         condition_free(condition);
 322
 323         strshorten(u.release, 4);
 324         strcpy(strchr(u.release, 0), "*");
 325
 326         condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
 327         assert_se(condition);
 328         assert_se(condition_test(condition) > 0);
 329         condition_free(condition);
 330
 331         /* 0.1.2 would be a very very very old kernel */
 332         condition = condition_new(CONDITION_KERNEL_VERSION, "> 0.1.2", false, false);
 333         assert_se(condition);
 334         assert_se(condition_test(condition) > 0);
 335         condition_free(condition);
 336
 337         condition = condition_new(CONDITION_KERNEL_VERSION, ">0.1.2", false, false);
 338         assert_se(condition);
 339         assert_se(condition_test(condition) > 0);
 340         condition_free(condition);
 341
 342         condition = condition_new(CONDITION_KERNEL_VERSION, "'>0.1.2' '<9.0.0'", false, false);
 343         assert_se(condition);
 344         assert_se(condition_test(condition) > 0);
 345         condition_free(condition);
 346
 347         condition = condition_new(CONDITION_KERNEL_VERSION, "> 0.1.2 < 9.0.0", false, false);
 348         assert_se(condition);
 349         assert_se(condition_test(condition) == -EINVAL);
 350         condition_free(condition);
 351
 352         condition = condition_new(CONDITION_KERNEL_VERSION, ">", false, false);
 353         assert_se(condition);
 354         assert_se(condition_test(condition) == -EINVAL);
 355         condition_free(condition);
 356
 357         condition = condition_new(CONDITION_KERNEL_VERSION, ">= 0.1.2", false, false);
 358         assert_se(condition);
 359         assert_se(condition_test(condition) > 0);
 360         condition_free(condition);
 361
 362         condition = condition_new(CONDITION_KERNEL_VERSION, "< 0.1.2", false, false);
 363         assert_se(condition);
 364         assert_se(condition_test(condition) == 0);
 365         condition_free(condition);
 366
 367         condition = condition_new(CONDITION_KERNEL_VERSION, "<= 0.1.2", false, false);
 368         assert_se(condition);
 369         assert_se(condition_test(condition) == 0);
 370         condition_free(condition);
 371
 372         condition = condition_new(CONDITION_KERNEL_VERSION, "= 0.1.2", false, false);
 373         assert_se(condition);
 374         assert_se(condition_test(condition) == 0);
 375         condition_free(condition);
 376
 377         /* 4711.8.15 is a very very very future kernel */
 378         condition = condition_new(CONDITION_KERNEL_VERSION, "< 4711.8.15", false, false);
 379         assert_se(condition);
 380         assert_se(condition_test(condition) > 0);
 381         condition_free(condition);
 382
 383         condition = condition_new(CONDITION_KERNEL_VERSION, "<= 4711.8.15", false, false);
 384         assert_se(condition);
 385         assert_se(condition_test(condition) > 0);
 386         condition_free(condition);
 387
 388         condition = condition_new(CONDITION_KERNEL_VERSION, "= 4711.8.15", false, false);
 389         assert_se(condition);
 390         assert_se(condition_test(condition) == 0);
 391         condition_free(condition);
 392
 393         condition = condition_new(CONDITION_KERNEL_VERSION, "> 4711.8.15", false, false);
 394         assert_se(condition);
 395         assert_se(condition_test(condition) == 0);
 396         condition_free(condition);
 397
 398         condition = condition_new(CONDITION_KERNEL_VERSION, ">= 4711.8.15", false, false);
 399         assert_se(condition);
 400         assert_se(condition_test(condition) == 0);
 401         condition_free(condition);
 402
 403         assert_se(uname(&u) >= 0);
 404
 405         v = strjoina(">=", u.release);
 406         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 407         assert_se(condition);
 408         assert_se(condition_test(condition) > 0);
 409         condition_free(condition);
 410
 411         v = strjoina("=  ", u.release);
 412         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 413         assert_se(condition);
 414         assert_se(condition_test(condition) > 0);
 415         condition_free(condition);
 416
 417         v = strjoina("<=", u.release);
 418         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 419         assert_se(condition);
 420         assert_se(condition_test(condition) > 0);
 421         condition_free(condition);
 422
 423         v = strjoina("> ", u.release);
 424         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 425         assert_se(condition);
 426         assert_se(condition_test(condition) == 0);
 427         condition_free(condition);
 428
 429         v = strjoina("<   ", u.release);
 430         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 431         assert_se(condition);
 432         assert_se(condition_test(condition) == 0);
 433         condition_free(condition);
 434 }
 435
 436 static void test_condition_test_null(void) {
 437         Condition *condition;
 438
 439         condition = condition_new(CONDITION_NULL, NULL, false, false);
 440         assert_se(condition);
 441         assert_se(condition_test(condition) > 0);
 442         condition_free(condition);
 443
 444         condition = condition_new(CONDITION_NULL, NULL, false, true);
 445         assert_se(condition);
 446         assert_se(condition_test(condition) == 0);
 447         condition_free(condition);
 448 }
 449
 450 static void test_condition_test_security(void) {
 451         Condition *condition;
 452
 453         condition = condition_new(CONDITION_SECURITY, "garbage oifdsjfoidsjoj", false, false);
 454         assert_se(condition);
 455         assert_se(condition_test(condition) == 0);
 456         condition_free(condition);
 457
 458         condition = condition_new(CONDITION_SECURITY, "selinux", false, true);
 459         assert_se(condition);
 460         assert_se(condition_test(condition) != mac_selinux_use());
 461         condition_free(condition);
 462
 463         condition = condition_new(CONDITION_SECURITY, "apparmor", false, false);
 464         assert_se(condition);
 465         assert_se(condition_test(condition) == mac_apparmor_use());
 466         condition_free(condition);
 467
 468         condition = condition_new(CONDITION_SECURITY, "tomoyo", false, false);
 469         assert_se(condition);
 470         assert_se(condition_test(condition) == mac_tomoyo_use());
 471         condition_free(condition);
 472
 473         condition = condition_new(CONDITION_SECURITY, "ima", false, false);
 474         assert_se(condition);
 475         assert_se(condition_test(condition) == use_ima());
 476         condition_free(condition);
 477
 478         condition = condition_new(CONDITION_SECURITY, "smack", false, false);
 479         assert_se(condition);
 480         assert_se(condition_test(condition) == mac_smack_use());
 481         condition_free(condition);
 482
 483         condition = condition_new(CONDITION_SECURITY, "audit", false, false);
 484         assert_se(condition);
 485         assert_se(condition_test(condition) == use_audit());
 486         condition_free(condition);
 487
 488         condition = condition_new(CONDITION_SECURITY, "uefi-secureboot", false, false);
 489         assert_se(condition);
 490         assert_se(condition_test(condition) == is_efi_secure_boot());
 491         condition_free(condition);
 492 }
 493
 494 static void print_securities(void) {
 495         log_info("------ enabled security technologies ------");
 496         log_info("SELinux: %s", yes_no(mac_selinux_use()));
 497         log_info("AppArmor: %s", yes_no(mac_apparmor_use()));
 498         log_info("Tomoyo: %s", yes_no(mac_tomoyo_use()));
 499         log_info("IMA: %s", yes_no(use_ima()));
 500         log_info("SMACK: %s", yes_no(mac_smack_use()));
 501         log_info("Audit: %s", yes_no(use_audit()));
 502         log_info("UEFI secure boot: %s", yes_no(is_efi_secure_boot()));
 503         log_info("-------------------------------------------");
 504 }
 505
 506 static void test_condition_test_virtualization(void) {
 507         Condition *condition;
 508         const char *virt;
 509         int r;
 510
 511         condition = condition_new(CONDITION_VIRTUALIZATION, "garbage oifdsjfoidsjoj", false, false);
 512         assert_se(condition);
 513         r = condition_test(condition);
 514         if (ERRNO_IS_PRIVILEGE(r))
 515                 return;
 516         log_info("ConditionVirtualization=garbage → %i", r);
 517         assert_se(r == 0);
 518         condition_free(condition);
 519
 520         condition = condition_new(CONDITION_VIRTUALIZATION, "container", false, false);
 521         assert_se(condition);
 522         r = condition_test(condition);
 523         log_info("ConditionVirtualization=container → %i", r);
 524         assert_se(r == !!detect_container());
 525         condition_free(condition);
 526
 527         condition = condition_new(CONDITION_VIRTUALIZATION, "vm", false, false);
 528         assert_se(condition);
 529         r = condition_test(condition);
 530         log_info("ConditionVirtualization=vm → %i", r);
 531         assert_se(r == (detect_vm() && !detect_container()));
 532         condition_free(condition);
 533
 534         condition = condition_new(CONDITION_VIRTUALIZATION, "private-users", false, false);
 535         assert_se(condition);
 536         r = condition_test(condition);
 537         log_info("ConditionVirtualization=private-users → %i", r);
 538         assert_se(r == !!running_in_userns());
 539         condition_free(condition);
 540
 541         NULSTR_FOREACH(virt,
 542                        "kvm\0"
 543                        "qemu\0"
 544                        "bochs\0"
 545                        "xen\0"
 546                        "uml\0"
 547                        "vmware\0"
 548                        "oracle\0"
 549                        "microsoft\0"
 550                        "zvm\0"
 551                        "parallels\0"
 552                        "bhyve\0"
 553                        "vm_other\0") {
 554
 555                 condition = condition_new(CONDITION_VIRTUALIZATION, virt, false, false);
 556                 assert_se(condition);
 557                 r = condition_test(condition);
 558                 log_info("ConditionVirtualization=%s → %i", virt, r);
 559                 assert_se(r >= 0);
 560                 condition_free(condition);
 561         }
 562 }
 563
 564 static void test_condition_test_user(void) {
 565         Condition *condition;
 566         char* uid;
 567         char* username;
 568         int r;
 569
 570         condition = condition_new(CONDITION_USER, "garbage oifdsjfoidsjoj", false, false);
 571         assert_se(condition);
 572         r = condition_test(condition);
 573         log_info("ConditionUser=garbage → %i", r);
 574         assert_se(r == 0);
 575         condition_free(condition);
 576
 577         assert_se(asprintf(&uid, "%"PRIu32, UINT32_C(0xFFFF)) > 0);
 578         condition = condition_new(CONDITION_USER, uid, false, false);
 579         assert_se(condition);
 580         r = condition_test(condition);
 581         log_info("ConditionUser=%s → %i", uid, r);
 582         assert_se(r == 0);
 583         condition_free(condition);
 584         free(uid);
 585
 586         assert_se(asprintf(&uid, "%u", (unsigned)getuid()) > 0);
 587         condition = condition_new(CONDITION_USER, uid, false, false);
 588         assert_se(condition);
 589         r = condition_test(condition);
 590         log_info("ConditionUser=%s → %i", uid, r);
 591         assert_se(r > 0);
 592         condition_free(condition);
 593         free(uid);
 594
 595         assert_se(asprintf(&uid, "%u", (unsigned)getuid()+1) > 0);
 596         condition = condition_new(CONDITION_USER, uid, false, false);
 597         assert_se(condition);
 598         r = condition_test(condition);
 599         log_info("ConditionUser=%s → %i", uid, r);
 600         assert_se(r == 0);
 601         condition_free(condition);
 602         free(uid);
 603
 604         username = getusername_malloc();
 605         assert_se(username);
 606         condition = condition_new(CONDITION_USER, username, false, false);
 607         assert_se(condition);
 608         r = condition_test(condition);
 609         log_info("ConditionUser=%s → %i", username, r);
 610         assert_se(r > 0);
 611         condition_free(condition);
 612         free(username);
 613
 614         username = (char*)(geteuid() == 0 ? NOBODY_USER_NAME : "root");
 615         condition = condition_new(CONDITION_USER, username, false, false);
 616         assert_se(condition);
 617         r = condition_test(condition);
 618         log_info("ConditionUser=%s → %i", username, r);
 619         assert_se(r == 0);
 620         condition_free(condition);
 621
 622         condition = condition_new(CONDITION_USER, "@system", false, false);
 623         assert_se(condition);
 624         r = condition_test(condition);
 625         log_info("ConditionUser=@system → %i", r);
 626         if (uid_is_system(getuid()) || uid_is_system(geteuid()))
 627                 assert_se(r > 0);
 628         else
 629                 assert_se(r == 0);
 630         condition_free(condition);
 631 }
 632
 633 static void test_condition_test_group(void) {
 634         Condition *condition;
 635         char* gid;
 636         char* groupname;
 637         gid_t *gids, max_gid;
 638         int ngroups_max, ngroups, r, i;
 639
 640         assert_se(0 < asprintf(&gid, "%u", UINT32_C(0xFFFF)));
 641         condition = condition_new(CONDITION_GROUP, gid, false, false);
 642         assert_se(condition);
 643         r = condition_test(condition);
 644         log_info("ConditionGroup=%s → %i", gid, r);
 645         assert_se(r == 0);
 646         condition_free(condition);
 647         free(gid);
 648
 649         assert_se(0 < asprintf(&gid, "%u", getgid()));
 650         condition = condition_new(CONDITION_GROUP, gid, false, false);
 651         assert_se(condition);
 652         r = condition_test(condition);
 653         log_info("ConditionGroup=%s → %i", gid, r);
 654         assert_se(r > 0);
 655         condition_free(condition);
 656         free(gid);
 657
 658         ngroups_max = sysconf(_SC_NGROUPS_MAX);
 659         assert(ngroups_max > 0);
 660
 661         gids = newa(gid_t, ngroups_max);
 662
 663         ngroups = getgroups(ngroups_max, gids);
 664         assert(ngroups >= 0);
 665
 666         max_gid = getgid();
 667         for (i = 0; i < ngroups; i++) {
 668                 assert_se(0 < asprintf(&gid, "%u", gids[i]));
 669                 condition = condition_new(CONDITION_GROUP, gid, false, false);
 670                 assert_se(condition);
 671                 r = condition_test(condition);
 672                 log_info("ConditionGroup=%s → %i", gid, r);
 673                 assert_se(r > 0);
 674                 condition_free(condition);
 675                 free(gid);
 676                 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
 677
 678                 groupname = gid_to_name(gids[i]);
 679                 assert_se(groupname);
 680                 condition = condition_new(CONDITION_GROUP, groupname, false, false);
 681                 assert_se(condition);
 682                 r = condition_test(condition);
 683                 log_info("ConditionGroup=%s → %i", groupname, r);
 684                 assert_se(r > 0);
 685                 condition_free(condition);
 686                 free(groupname);
 687                 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
 688         }
 689
 690         assert_se(0 < asprintf(&gid, "%u", max_gid+1));
 691         condition = condition_new(CONDITION_GROUP, gid, false, false);
 692         assert_se(condition);
 693         r = condition_test(condition);
 694         log_info("ConditionGroup=%s → %i", gid, r);
 695         assert_se(r == 0);
 696         condition_free(condition);
 697         free(gid);
 698
 699         groupname = (char*)(getegid() == 0 ? NOBODY_GROUP_NAME : "root");
 700         condition = condition_new(CONDITION_GROUP, groupname, false, false);
 701         assert_se(condition);
 702         r = condition_test(condition);
 703         log_info("ConditionGroup=%s → %i", groupname, r);
 704         assert_se(r == 0);
 705         condition_free(condition);
 706 }
 707
 708 static void test_condition_test_cpus_one(const char *s, bool result) {
 709         Condition *condition;
 710         int r;
 711
 712         log_debug("%s=%s", condition_type_to_string(CONDITION_CPUS), s);
 713
 714         condition = condition_new(CONDITION_CPUS, s, false, false);
 715         assert_se(condition);
 716
 717         r = condition_test(condition);
 718         assert_se(r >= 0);
 719         assert_se(r == result);
 720         condition_free(condition);
 721 }
 722
 723 static void test_condition_test_cpus(void) {
 724         _cleanup_free_ char *t = NULL;
 725         int cpus;
 726
 727         cpus = cpus_in_affinity_mask();
 728         assert_se(cpus >= 0);
 729
 730         test_condition_test_cpus_one("> 0", true);
 731         test_condition_test_cpus_one(">= 0", true);
 732         test_condition_test_cpus_one("!= 0", true);
 733         test_condition_test_cpus_one("<= 0", false);
 734         test_condition_test_cpus_one("< 0", false);
 735         test_condition_test_cpus_one("= 0", false);
 736
 737         test_condition_test_cpus_one("> 100000", false);
 738         test_condition_test_cpus_one("= 100000", false);
 739         test_condition_test_cpus_one(">= 100000", false);
 740         test_condition_test_cpus_one("< 100000", true);
 741         test_condition_test_cpus_one("!= 100000", true);
 742         test_condition_test_cpus_one("<= 100000", true);
 743
 744         assert_se(asprintf(&t, "= %i", cpus) >= 0);
 745         test_condition_test_cpus_one(t, true);
 746         t = mfree(t);
 747
 748         assert_se(asprintf(&t, "<= %i", cpus) >= 0);
 749         test_condition_test_cpus_one(t, true);
 750         t = mfree(t);
 751
 752         assert_se(asprintf(&t, ">= %i", cpus) >= 0);
 753         test_condition_test_cpus_one(t, true);
 754         t = mfree(t);
 755
 756         assert_se(asprintf(&t, "!= %i", cpus) >= 0);
 757         test_condition_test_cpus_one(t, false);
 758         t = mfree(t);
 759
 760         assert_se(asprintf(&t, "< %i", cpus) >= 0);
 761         test_condition_test_cpus_one(t, false);
 762         t = mfree(t);
 763
 764         assert_se(asprintf(&t, "> %i", cpus) >= 0);
 765         test_condition_test_cpus_one(t, false);
 766         t = mfree(t);
 767 }
 768
 769 static void test_condition_test_memory_one(const char *s, bool result) {
 770         Condition *condition;
 771         int r;
 772
 773         log_debug("%s=%s", condition_type_to_string(CONDITION_MEMORY), s);
 774
 775         condition = condition_new(CONDITION_MEMORY, s, false, false);
 776         assert_se(condition);
 777
 778         r = condition_test(condition);
 779         assert_se(r >= 0);
 780         assert_se(r == result);
 781         condition_free(condition);
 782 }
 783
 784 static void test_condition_test_memory(void) {
 785         _cleanup_free_ char *t = NULL;
 786         uint64_t memory;
 787
 788         memory = physical_memory();
 789
 790         test_condition_test_memory_one("> 0", true);
 791         test_condition_test_memory_one(">= 0", true);
 792         test_condition_test_memory_one("!= 0", true);
 793         test_condition_test_memory_one("<= 0", false);
 794         test_condition_test_memory_one("< 0", false);
 795         test_condition_test_memory_one("= 0", false);
 796
 797         test_condition_test_memory_one("> 18446744073709547520", false);
 798         test_condition_test_memory_one("= 18446744073709547520", false);
 799         test_condition_test_memory_one(">= 18446744073709547520", false);
 800         test_condition_test_memory_one("< 18446744073709547520", true);
 801         test_condition_test_memory_one("!= 18446744073709547520", true);
 802         test_condition_test_memory_one("<= 18446744073709547520", true);
 803
 804         assert_se(asprintf(&t, "= %" PRIu64, memory) >= 0);
 805         test_condition_test_memory_one(t, true);
 806         t = mfree(t);
 807
 808         assert_se(asprintf(&t, "<= %" PRIu64, memory) >= 0);
 809         test_condition_test_memory_one(t, true);
 810         t = mfree(t);
 811
 812         assert_se(asprintf(&t, ">= %" PRIu64, memory) >= 0);
 813         test_condition_test_memory_one(t, true);
 814         t = mfree(t);
 815
 816         assert_se(asprintf(&t, "!= %" PRIu64, memory) >= 0);
 817         test_condition_test_memory_one(t, false);
 818         t = mfree(t);
 819
 820         assert_se(asprintf(&t, "< %" PRIu64, memory) >= 0);
 821         test_condition_test_memory_one(t, false);
 822         t = mfree(t);
 823
 824         assert_se(asprintf(&t, "> %" PRIu64, memory) >= 0);
 825         test_condition_test_memory_one(t, false);
 826         t = mfree(t);
 827 }
 828
 829 int main(int argc, char *argv[]) {
 830         test_setup_logging(LOG_DEBUG);
 831
 832         test_condition_test_path();
 833         test_condition_test_ac_power();
 834         test_condition_test_host();
 835         test_condition_test_architecture();
 836         test_condition_test_kernel_command_line();
 837         test_condition_test_kernel_version();
 838         test_condition_test_null();
 839         test_condition_test_security();
 840         print_securities();
 841         test_condition_test_virtualization();
 842         test_condition_test_user();
 843         test_condition_test_group();
 844         test_condition_test_control_group_controller();
 845         test_condition_test_cpus();
 846         test_condition_test_memory();
 847
 848         return 0;
 849 }